A vulnerability in Adobe Acrobat Reader allows attackers to take over entire systems. Adobe finally rolled out a patch on April 11.
Adobe is dealing with a critical vulnerability in Acrobat Reader that has been actively exploited for months via infected PDF files. Researchers warn that this could potentially allow attackers to gain full control over systems.
Attack starts with a single PDF
The vulnerability is exploited through specially crafted PDF documents. As soon as a user opens such a file, the attack can begin without further interaction. This makes the risk particularly high, as a single click is enough to compromise a system. According to researcher Haifei Li, it involves an advanced “fingerprinting” exploit that specifically targets the victim’s environment to optimize the attack.
The attack exploits internal functions within Adobe Reader to collect sensitive data. This includes reading local files via APIs. The vulnerability can also serve as a stepping stone to more extensive attacks, such as remote code execution (RCE) or sandbox escapes. In those cases, attackers can also take over the entire system.
Targeted phishing campaigns
The malicious PDFs are distributed via phishing, using lures in Russian that refer to the oil and gas sector. This indicates targeted attacks, although the vulnerability is technically broadly applicable. The attack has reportedly been active since December, and Adobe has been notified but has not yet released a security update. As a result, the flaw remains an active zero-day with no immediate solution for users.
Adobe rolls out patch
It apparently took public pressure to spur Adobe into action. On April 11, Adobe finally rolled out the necessary patches for Acrobat DC, Acrobat Reader DC, and Acrobat 2014: this also marked the first public acknowledgment of the vulnerability by the company and for researcher Haifei Li, who discovered it.
Until a patch is installed, the advice is simple but strict: do not open PDF files from unknown or untrustworthy sources.
This article originally appeared on April 10 and was updated with the latest information.